Information Technology Security

By Sergiu Gatlan,  Bleeping Computer ​Microsoft has mitigated an Azure outage that lasted more than two hours and took down multiple services for customers across North and Latin America. The company says the incident started around 18:22 UTC and impacted services that leverage Azure Front Door (AFD), its modern cloud Content Delivery Network (CDN). "This issue is impacting multiple geographies, mostly in North America and Latin America," Redmond explained when it first acknowledged the outage on the Azure status page, saying it was caused by what it described as a "configuration change." "We have rolled back this change and, from 19:25 UTC, the majority of services are seeing recovery. Many Microsoft services have failed away from AFD, in response to this issue." However, customers have also reported experiencing errors connecting to Azure services (including Azure DevOps) in the United Kingdom, with the Azure DevOps status page also tagging the issues ...

By Sergiu Gatlan,  Bleeping Computer Microsoft confirmed today that a nine-hour outage on Tuesday, which took down and disrupted multiple Microsoft 365 and Azure services worldwide, was triggered by a distributed denial-of-service (DDoS) attack. Redmond says the outage impacted Microsoft Entra, some Microsoft 365 and Microsoft Purview services (including Intune, Power BI, and Power Platform), as well as Azure App Services, Application Insights, Azure IoT Central, Azure Log Search Alerts, Azure Policy, and the Azure portal. The company confirmed in a mitigation statement published today that the root cause behind yesterday's outage was a DDoS attack, although it has yet to link it to a specific threat actor. "While the initial trigger event was a Distributed Denial-of-Service (DDoS) attack, which activated our DDoS protection mechanisms, initial investigations suggest that an error in the implementation of our defenses amplified the impact of the attack rather than mitigating i...

By Sergiu Gatlan,  Bleeping Computer Microsoft says an Azure configuration change caused a major Microsoft 365 outage on Thursday, affecting customers across the Central US region. This massive outage started around 6:00 PM EST and prevented users from accessing various Microsoft 365 apps and services. The list of services impacted by the outage includes Microsoft Defender , Intune, Teams, PowerBI, Fabric, OneNote, OneDrive for Business, SharePoint Online, Windows 365, Viva Engage, Microsoft Purview, and the Microsoft 365 admin center. Xbox Support confirmed that the Xbox Live service was also hit by the issue, saying gamers had problems logging into their accounts. Throughout the outage, Downdetector has received tens of thousands of service issue reports, with affected Xbox users experiencing server connection issues and saying they couldn't log in. After acknowledging the outage, Microsoft said, "We're working on rerouting the impacted traffic to alternate systems to ...

By Sergiu Gatlan, Bleeping Computer Microsoft has shared guidance to help admins defend their Windows enterprise environments against KrbRelayUp attacks that enable attackers to gain SYSTEM privileges on Windows systems with default configurations. Attackers can launch this attack using the KrbRelayUp tool developed by security researcher Mor Davidovich as an open-source wrapper for Rubeus, KrbRelay, SCMUACBypass, PowerMad/SharpMad, Whisker, and ADCSPwn privilege escalation tools. Since late April 2022, when the tool was first shared on GitHub, threat actors could escalate their permissions to SYSTEM in Windows domain environments with default settings (where LDAP signing is not enforced). Davidovich released an updated version of KrbRelayUp on Monday that also works when LDAP signing is enforced and will provide attackers with SYSTEM privileges if Extended Protection for Authentication (EPA) for Active Directory Certificate Services (AD CS) is not enabled. Microsoft says that this pri...